AI-Themed Phishing Lures Top Kaspersky Click-Rate Test at 45%

Kaspersky said it analyzed anonymized, voluntarily provided data from its Phishing Simulator to establish which themes work best against employees and which fall flat. "A high click rate among users clearly highlights what specific cybersecurity training is required," the researchers said.

Five topics produced the strongest results for attackers: AI and technology, healthcare and insurance, IT policies and compliance, gifts and promotions, and HR and corporate communications. AI and technology was the best-performing category overall, meaning nearly every second recipient of such a message would click a malicious link and potentially receive malware or hand over login credentials.

Healthcare and insurance lures deceived an average of 28% of recipients, but one message stood out: an email about a sanitary inspection report reached a 92% click-through rate. IT policies and compliance ranked third at 26%, followed by gifts and promotions at 24%. Within the promotions group, 66% of recipients clicked an email inviting them to wear their national team's football jersey and win a prize. HR and corporate communications produced a 22% click-through rate, and Kaspersky described emails raising sensitive, high-interest internal topics as "especially dangerous."

Svetlana Kalashnikova, a security awareness expert at Kaspersky, said people respond naturally to sensitive and highly contextual emails, particularly when a phishing message mimics their exact workflow or local specifics. "Knowing this, cybercriminals make their traps more personalized and this trend is set to accelerate with the rise of generative AI," she said.

Kaspersky said regular training and attack simulations cut phishing susceptibility rates from 60% to 5–7%, citing its KASAP effectiveness analytics. Kalashnikova said organizations should run ongoing cybersecurity awareness programs for all employees to protect people and businesses from human-targeting threats.

According to Kaspersky, phishing remains the most prevalent cyber-incident for businesses at any stage of growth and ranks top among incidents that lead to damaging business consequences. Attacks on people are growing more sophisticated, faster and broader in scope, and AI has turned them into multi-stage efforts, the company said.

TechRadar noted that AI has made malicious emails almost indistinguishable from legitimate communications, pushing identification toward links, attachments and overall tone. A sense of urgency remains a common marker: legitimate organizations rarely threaten account suspension within 24 hours, host documents on unrecognizable third-party services or send attachments in executable formats. Checking the domain an email was sent from is still useful, the report added, since most phishing messages originate from a stolen address or one created on a public email service.